apache / apache/maven-toolchains-plugin

No timeout for external java process in doGetToolchainModel

Open
#170 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
27
Forks
31
PR merge metrics
No merged PRs in 30d

Description

## Summary

launches a subprocess and calls without a timeout. A hung or slow JVM process will block Maven indefinitely.

## Location

https://github.com/apache/maven-toolchains-plugin/blob/master/src/main/java/org/apache/maven/plugins/toolchain/jdk/ToolchainDiscoverer.java#L243-L250

## Code

## Problem

without arguments blocks forever until the process completes. If the discovered JDK's java binary is:
- A script that hangs
- A broken/corrupted installation
- An interactive shell
- Extremely slow (e.g., on a network filesystem)

Maven will hang indefinitely with no way to recover other than killing the process.

## Impact

During JDK toolchain discovery, a single problematic JDK installation can cause the entire Maven build to hang permanently. Since discovery scans many directories (including user-controlled paths like , , etc.), a corrupted or slow JDK in any of these locations blocks the build.

## Suggested Fix

Use with a reasonable timeout (e.g., 30 seconds), and if the process times out, destroy it and log a warning:

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/main/java/org/apache/maven/plugins/toolchain/jdk/ToolchainDiscoverer.java at lines 243-250 and inspect how doGetToolchainModel launches the external Java process. Add bounded process handling with cleanup and a warning on timeout, then verify that a hung or slow JDK no longer blocks toolchain discovery.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.